BUG: unable to handle kernel NULL pointer dereference in hfs_find_init

[Hui Guo]

Hi Kernel Maintainers,
we found a crash "BUG: unable to handle kernel NULL pointer
dereference in hfs_find_init" (it seems a KASAN and make the kernel
reboot) in upstream, we have successfully reproduced it manually:


HEAD Commit: 9852d85ec9d492ebef56dc5f229416c925758edc(tag 'v6.12-rc1')
kernel config: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/6.12.config


repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/0f99fb17356ecba84aa11ff7892598348ab4a96b/repro.report
console output:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/0f99fb17356ecba84aa11ff7892598348ab4a96b/log0
syz reproducer:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/0f99fb17356ecba84aa11ff7892598348ab4a96b/repro.prog
c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/0f99fb17356ecba84aa11ff7892598348ab4a96b/repro.cprog


Please let me know if there is anything I can help.
Best,
Hui Guo

This is the crash log I got by reproducing the bug based on the above
environment，
I have piped this log through decode_stacktrace.sh for better
understand the cause of the bug.
================================================================================
root@syzkaller:~# ./syz-execprog
/data/ghui/docker_data/workdir/upstream/ghui_syzkaller_upstream_linux_v6.11_2_upstream/crashes/0f99fb17356ecba84aa11ff7892598348ab4a96b/repro.pg
2024/10/13 02:13:14 parsed 1 programs
[ 1715.063040][T13595] Adding 124996k swap on ./swap-file. Priority:0
extents:1 across:124996k
[ 1715.956030][T13626] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 1715.957157][T13626] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 1715.958207][T13626] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 1715.959567][T13626] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 1715.960644][T13626] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 1715.964767][T13626] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 1716.015110][T13760] wlan0: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 1716.016184][T13760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1716.031523][T13561] wlan1: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 1716.032577][T13561] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1716.035527][T13625] chnl_net:caif_netlink_parms(): no params data found
[ 1716.061284][T13625] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.062217][T13625] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1716.063172][T13625] bridge_slave_0: entered allmulticast mode
[ 1716.064077][T13625] bridge_slave_0: entered promiscuous mode
[ 1716.065092][T13625] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.066018][T13625] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1716.066969][T13625] bridge_slave_1: entered allmulticast mode
[ 1716.067872][T13625] bridge_slave_1: entered promiscuous mode
[ 1716.073685][T13625] bond0: (slave bond_slave_0): Enslaving as an
active interface with an up link
[ 1716.075269][T13625] bond0: (slave bond_slave_1): Enslaving as an
active interface with an up link
[ 1716.083754][T13625] team0: Port device team_slave_0 added
[ 1716.084756][T13625] team0: Port device team_slave_1 added
[ 1716.090299][T13625] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 1716.091177][T13625] batman_adv: batadv0: The MTU of interface
batadv_slave_0 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this inter.
[ 1716.094348][T13625] batman_adv: batadv0: Not using interface
batadv_slave_0 (retrying later): interface not active
[ 1716.095772][T13625] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 1716.096636][T13625] batman_adv: batadv0: The MTU of interface
batadv_slave_1 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this inter.
[ 1716.099888][T13625] batman_adv: batadv0: Not using interface
batadv_slave_1 (retrying later): interface not active
[ 1716.110722][T13625] hsr_slave_0: entered promiscuous mode
[ 1716.112226][T13625] hsr_slave_1: entered promiscuous mode
[ 1716.126167][T13625] netdevsim netdevsim10 netdevsim0: renamed from eth0
[ 1716.127484][T13625] netdevsim netdevsim10 netdevsim1: renamed from eth1
[ 1716.128745][T13625] netdevsim netdevsim10 netdevsim2: renamed from eth2
[ 1716.130133][T13625] netdevsim netdevsim10 netdevsim3: renamed from eth3
[ 1716.135631][T13625] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.136556][T13625] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1716.137500][T13625] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.138429][T13625] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1716.144506][T13625] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1716.146837][T13886] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1716.148752][T13886] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1716.151564][T13625] 8021q: adding VLAN 0 to HW filter on device team0
[ 1716.153279][T13886] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.154090][T13886] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1716.156241][T13886] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.157869][T13886] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1716.181717][T13625] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1716.209621][T13625] veth0_vlan: entered promiscuous mode
[ 1716.211036][T13625] veth1_vlan: entered promiscuous mode
[ 1716.214231][T13625] veth0_macvtap: entered promiscuous mode
[ 1716.215195][T13625] veth1_macvtap: entered promiscuous mode
[ 1716.217047][T13625] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 1716.218971][T13625] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 1716.220345][T13625] netdevsim netdevsim10 netdevsim0: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1716.221464][T13625] netdevsim netdevsim10 netdevsim1: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1716.222545][T13625] netdevsim netdevsim10 netdevsim2: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1716.223534][T13625] netdevsim netdevsim10 netdevsim3: set [1, 0]
type 2 family 0 port 6081 - 0
2024/10/13 02:13:18 executed programs: 0
[ 1716.322303][ T4649] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 1716.324231][ T4649] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 1716.325959][ T4649] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 1716.327813][ T4649] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 1716.329786][ T4649] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 1716.331450][ T4649] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 1716.353232][T15016] chnl_net:caif_netlink_parms(): no params data found
[ 1716.373312][T15016] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.374266][T15016] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1716.375198][T15016] bridge_slave_0: entered allmulticast mode
[ 1716.376084][T15016] bridge_slave_0: entered promiscuous mode
[ 1716.377121][T15016] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.378028][T15016] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1716.378991][T15016] bridge_slave_1: entered allmulticast mode
[ 1716.379866][T15016] bridge_slave_1: entered promiscuous mode
[ 1716.385833][T15016] bond0: (slave bond_slave_0): Enslaving as an
active interface with an up link
[ 1716.387930][T15016] bond0: (slave bond_slave_1): Enslaving as an
active interface with an up link
[ 1716.396402][T15016] team0: Port device team_slave_0 added
[ 1716.398172][T15016] team0: Port device team_slave_1 added
[ 1716.406211][T15016] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 1716.407768][T15016] batman_adv: batadv0: The MTU of interface
batadv_slave_0 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this inter.
[ 1716.413399][T15016] batman_adv: batadv0: Not using interface
batadv_slave_0 (retrying later): interface not active
[ 1716.415633][T15016] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 1716.416987][T15016] batman_adv: batadv0: The MTU of interface
batadv_slave_1 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this inter.
[ 1716.420758][T15016] batman_adv: batadv0: Not using interface
batadv_slave_1 (retrying later): interface not active
[ 1716.426564][T15016] hsr_slave_0: entered promiscuous mode
[ 1716.427371][T15016] hsr_slave_1: entered promiscuous mode
[ 1716.428140][T15016] debugfs: Directory 'hsr0' with parent 'hsr'
already present!
[ 1716.429138][T15016] Cannot create hsr debugfs directory
[ 1716.953119][T15016] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 1716.955519][T15016] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 1716.957883][T15016] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 1716.960421][T15016] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 1716.968025][T15016] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.970004][T15016] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1716.971838][T15016] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.973583][T15016] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1716.980663][T15016] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1716.983042][T15751] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1716.985009][T15751] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1716.988364][T15016] 8021q: adding VLAN 0 to HW filter on device team0
[ 1716.990438][T13561] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1716.991352][T13561] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1716.993024][T13561] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1716.993948][T13561] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1717.016034][T15016] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1717.021142][T15016] veth0_vlan: entered promiscuous mode
[ 1717.022564][T15016] veth1_vlan: entered promiscuous mode
[ 1717.025807][T15016] veth0_macvtap: entered promiscuous mode
[ 1717.026960][T15016] veth1_macvtap: entered promiscuous mode
[ 1717.028902][T15016] batman_adv: The newly added mac address
(aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 1717.030270][T15016] batman_adv: It is strongly recommended to keep
mac addresses unique to avoid problems!
[ 1717.031702][T15016] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 1717.033580][T15016] batman_adv: The newly added mac address
(aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 1717.034932][T15016] batman_adv: It is strongly recommended to keep
mac addresses unique to avoid problems!
[ 1717.036334][T15016] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 1717.037905][T15016] netdevsim netdevsim0 netdevsim0: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1717.039133][T15016] netdevsim netdevsim0 netdevsim1: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1717.040277][T15016] netdevsim netdevsim0 netdevsim2: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1717.041440][T15016] netdevsim netdevsim0 netdevsim3: set [1, 0]
type 2 family 0 port 6081 - 0
[ 1717.116220][T13760] wlan0: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 1717.117190][T13760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1717.119939][T15751] wlan1: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 1717.121966][T15751] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 1717.128890][T16063] loop0: detected capacity change from 0 to 64
[ 1717.130222][T16063] BUG: kernel NULL pointer dereference, address:
0000000000000040
[ 1717.131287][T16063] #PF: supervisor read access in kernel mode
[ 1717.132067][T16063] #PF: error_code(0x0000) - not-present page
[ 1717.132844][T16063] PGD 129e5a067 P4D 129e5a067 PUD 1199de067 PMD 0
[ 1717.133700][T16063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 1717.134454][T16063] CPU: 4 UID: 0 PID: 16063 Comm: syz.0.15 Not
tainted 6.12.0-rc1 #5
[ 1717.135494][T16063] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.15.0-1 04/01/2014
[1717.136709][T16063] RIP: 0010:hfs_find_init
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/bfind.c:21)
[ 1717.137407][T16063] Code: 0f 1f 00 55 48 89 e5 41 55 41 54 49 89 f4
53 48 89 fb e8 58 43 9f ff 49 89 5c 24 10 be c0 0c 00 00 49 c7 44 24
18 00 00 00 00 <8b> 43 40 8d 7c 00 09
All code
========
0: 0f 1f 00 nopl (%rax)
3: 55 push %rbp
4: 48 89 e5 mov %rsp,%rbp
7: 41 55 push %r13
9: 41 54 push %r12
b: 49 89 f4 mov %rsi,%r12
e: 53 push %rbx
f: 48 89 fb mov %rdi,%rbx
12: e8 58 43 9f ff call 0xffffffffff9f436f
17: 49 89 5c 24 10 mov %rbx,0x10(%r12)
1c: be c0 0c 00 00 mov $0xcc0,%esi
21: 49 c7 44 24 18 00 00 movq $0x0,0x18(%r12)
28: 00 00
2a:* 8b 43 40 mov 0x40(%rbx),%eax <-- trapping instruction
2d: 8d 7c 00 09 lea 0x9(%rax,%rax,1),%edi

Code starting with the faulting instruction
===========================================
0: 8b 43 40 mov 0x40(%rbx),%eax
3: 8d 7c 00 09 lea 0x9(%rax,%rax,1),%edi
[ 1717.140059][T16063] RSP: 0018:ffff888125713978 EFLAGS: 00010293
[ 1717.141068][T16063] RAX: 0000000000000000 RBX: 0000000000000000
RCX: ffffffff81960dd1
[ 1717.142279][T16063] RDX: ffff888109814ec0 RSI: 0000000000000cc0
RDI: 0000000000000000
[ 1717.143481][T16063] RBP: ffff888125713990 R08: ffff888125713988
R09: 0000000000000000
[ 1717.144689][T16063] R10: 0000000000000000 R11: 0000000000000000
R12: ffff8881257139a8
[ 1717.145864][T16063] R13: 0000000000000000 R14: 0000000000000000
R15: 0000000000000004
[ 1717.147100][T16063] FS: 00007fe8154fd640(0000)
GS:ffff88813bb00000(0000) knlGS:0000000000000000
[ 1717.148462][T16063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1717.149538][T16063] CR2: 0000000000000040 CR3: 000000011a2a2000
CR4: 00000000000006f0
[ 1717.150744][T16063] Call Trace:
[ 1717.151241][T16063] <TASK>
[1717.151699][T16063] ? show_regs
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/dumpstack.c:479)
[1717.152399][T16063] ? __die
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/dumpstack.c:421
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/dumpstack.c:434)
[1717.153004][T16063] ? page_fault_oops
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:711)
[1717.153756][T16063] ? hfs_find_init
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/bfind.c:21)
[1717.154485][T16063] ? is_prefetch.constprop.0
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:171)
[1717.155318][T16063] ? kernelmode_fixup_or_oops.constprop.0
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:738)
[1717.156264][T16063] ? __bad_area_nosemaphore
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:787)
[1717.157133][T16063] ? find_vma
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/mm/mmap.c:968)
[1717.157795][T16063] ? bad_area_nosemaphore
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:835)
[1717.158598][T16063] ? exc_page_fault
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:1448
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:1481
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/mm/fault.c:1539)
[1717.159356][T16063] ? asm_exc_page_fault
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/idtentry.h:623)
[1717.160156][T16063] ? hfs_ext_read_extent
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/extent.c:196
(discriminator 1))
[1717.160959][T16063] ? hfs_find_init
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/bfind.c:21)
[1717.161722][T16063] ? hfs_find_init
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/bfind.c:19)
[1717.162442][T16063] hfs_ext_read_extent
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/extent.c:201)
[1717.163230][T16063] ? __sanitizer_cov_trace_const_cmp1
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kcov.c:302)
[1717.164225][T16063] ? __sanitizer_cov_trace_const_cmp4
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kcov.c:316)
[1717.165186][T16063] hfs_get_block
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/extent.c:367)
[1717.165961][T16063] block_read_full_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/buffer.c:2402
(discriminator 3))
[1717.166799][T16063] ? __pfx_hfs_get_block
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/extent.c:338)
[1717.167608][T16063] ? __pfx_hfs_read_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/inode.c:33)
[1717.168420][T16063] hfs_read_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/inode.c:35)
[1717.169111][T16063] filemap_read_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/mm/filemap.c:2367)
[1717.169867][T16063] do_read_cache_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/mm/filemap.c:3826)
[1717.170658][T16063] ? __pfx_hfs_read_folio
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/inode.c:33)
[1717.171463][T16063] read_cache_page
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/mm/filemap.c:3892
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/mm/filemap.c:3900)
[1717.172185][T16063] hfs_btree_open
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/btree.c:79)
[1717.172923][T16063] ? __bread_gfp
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/buffer.c:1496)
[1717.173609][T16063] hfs_mdb_get
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/mdb.c:199)
[1717.174275][T16063] hfs_fill_super
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/super.c:408)
[1717.175009][T16063] ? __sanitizer_cov_trace_cmp4
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kcov.c:289)
[1717.175887][T16063] ? __sanitizer_cov_trace_const_cmp4
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kcov.c:316)
[1717.176832][T16063] ? sb_set_blocksize
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/block/bdev.c:189)
[1717.177615][T16063] ? setup_bdev_super
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/super.c:1595)
[1717.178363][T16063] ? __pfx_hfs_fill_super
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/super.c:380)
[1717.179175][T16063] mount_bdev
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/super.c:1680)
[1717.179859][T16063] hfs_mount
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/super.c:458)
[1717.180477][T16063] legacy_get_tree
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/fs_context.c:664)
[1717.181166][T16063] vfs_get_tree
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/super.c:1801)
[1717.181861][T16063] path_mount
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:3508
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:3834)
[1717.182563][T16063] __x64_sys_mount
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:3848
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:4055
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:4032
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/namespace.c:4032)
[1717.183282][T16063] x64_sys_call
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/syscall_64.c:36)
[1717.184009][T16063] do_syscall_64
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:52
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/common.c:83)
[1717.184714][T16063] entry_SYSCALL_64_after_hwframe
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/entry_64.S:130)
[ 1717.185613][T16063] RIP: 0033:0x7fe81479e49e
[ 1717.186289][T16063] Code: 48 c7 c0 ff ff ff ff eb aa e8 5e 20 00 00
66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5
00 00 00 0f 05 <48> 3d 01 f0 ff ff 78
All code
========
0: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
7: eb aa jmp 0xffffffffffffffb3
9: e8 5e 20 00 00 call 0x206c
e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
15: 00 00 00
18: 0f 1f 40 00 nopl 0x0(%rax)
1c: f3 0f 1e fa endbr64
20: 49 89 ca mov %rcx,%r10
23: b8 a5 00 00 00 mov $0xa5,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 78 .byte 0x78

Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 78 .byte 0x78
[ 1717.189219][T16063] RSP: 002b:00007fe8154fcda8 EFLAGS: 00000246
ORIG_RAX: 00000000000000a5
[ 1717.190532][T16063] RAX: ffffffffffffffda RBX: 000000000000025c
RCX: 00007fe81479e49e
[ 1717.191730][T16063] RDX: 0000000020000240 RSI: 0000000020000040
RDI: 00007fe8154fce00
[ 1717.192929][T16063] RBP: 00007fe8154fce40 R08: 00007fe8154fce40
R09: 0000000003008800
[ 1717.194148][T16063] R10: 0000000003008800 R11: 0000000000000246
R12: 0000000020000240
[ 1717.195323][T16063] R13: 0000000020000040 R14: 00007fe8154fce00
R15: 0000000020000000
[ 1717.196566][T16063] </TASK>
[ 1717.197034][T16063] Modules linked in:
[ 1717.197632][T16063] CR2: 0000000000000040
[ 1717.198347][T16063] ---[ end trace 0000000000000000 ]---
[1717.199218][T16063] RIP: 0010:hfs_find_init
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/fs/hfs/bfind.c:21)
[ 1717.200018][T16063] Code: 0f 1f 00 55 48 89 e5 41 55 41 54 49 89 f4
53 48 89 fb e8 58 43 9f ff 49 89 5c 24 10 be c0 0c 00 00 49 c7 44 24
18 00 00 00 00 <8b> 43 40 8d 7c 00 09
All code
========
0: 0f 1f 00 nopl (%rax)
3: 55 push %rbp
4: 48 89 e5 mov %rsp,%rbp
7: 41 55 push %r13
9: 41 54 push %r12
b: 49 89 f4 mov %rsi,%r12
e: 53 push %rbx
f: 48 89 fb mov %rdi,%rbx
12: e8 58 43 9f ff call 0xffffffffff9f436f
17: 49 89 5c 24 10 mov %rbx,0x10(%r12)
1c: be c0 0c 00 00 mov $0xcc0,%esi
21: 49 c7 44 24 18 00 00 movq $0x0,0x18(%r12)
28: 00 00
2a:* 8b 43 40 mov 0x40(%rbx),%eax <-- trapping instruction
2d: 8d 7c 00 09 lea 0x9(%rax,%rax,1),%edi

Code starting with the faulting instruction
===========================================
0: 8b 43 40 mov 0x40(%rbx),%eax
3: 8d 7c 00 09 lea 0x9(%rax,%rax,1),%edi
[ 1717.202999][T16063] RSP: 0018:ffff888125713978 EFLAGS: 00010293
[ 1717.203929][T16063] RAX: 0000000000000000 RBX: 0000000000000000
RCX: ffffffff81960dd1
[ 1717.205136][T16063] RDX: ffff888109814ec0 RSI: 0000000000000cc0
RDI: 0000000000000000
[ 1717.206351][T16063] RBP: ffff888125713990 R08: ffff888125713988
R09: 0000000000000000
[ 1717.207566][T16063] R10: 0000000000000000 R11: 0000000000000000
R12: ffff8881257139a8
[ 1717.208763][T16063] R13: 0000000000000000 R14: 0000000000000000
R15: 0000000000000004
[ 1717.210026][T16063] FS: 00007fe8154fd640(0000)
GS:ffff88813bb00000(0000) knlGS:0000000000000000
[ 1717.211367][T16063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1717.212372][T16063] CR2: 0000000000000040 CR3: 000000011a2a2000
CR4: 00000000000006f0
[ 1717.213617][T16063] Kernel panic - not syncing: Fatal exception
[ 1717.214884][T16063] Kernel Offset: disabled
[ 1717.215464][T16063] Rebooting in 86400 seconds..